Pipeline Quickstart: Use the Log Timestamp
2 minute read
Overview
This is the sixth step in the Pipeline Quickstart guide. In the previous step, you learned how to Normalize disparate severity words so dashboards and alerts can rely on a consistent set.
In this section, you use the log timestamp as the data item time stamp.
There may be a slight mismatch between the root timestamp field and the timestamp in the log body. This is because the timestamp field is the ingestion time (when it was ingested by the Edge Delta agent), while the log timestamp is created by the application that generated the log. If you want to use the log timestamp only, you can add a Parse Timestamp processor to the stack.
See Manage Log Timestamps for information about why this happens.
1. Add Parse Timestamp Processor
- Click Add a processor.
- Select Parse Timestamp.
A Parse Timestamp processor is added to the processors stack:
2. Configure Parse Timestamp Processor
- Specify the location of the parsed log timestamp: Click Parse from and select attributes log_timestamp.
- To configure the processor to interpret the timestamp correctly, enter the go reference time in the Format field, but format it to match your logs. Enter:
Mon Jan 2 15:04:05 2006. This matches the log format:Wed Jul 16 02:35:48 2025.
- Click Save on the Parse Timestamp processor.
- Delete the
log_timestampattribute now that it has been processed.
Note: With the timestamp attribute removed, the size is reduced by 28%:
3. Save the Processor Node
- Click Save on the Delete processor.
- Then click Save on the entire processor stack.
The Pipeline is now configured but has not been deployed on your agents yet.
